Users Guide

ManualsBrandsDell ManualsBSAFEBSAFE SSL-J

Troubleshooting Guide

13.11.19

RSA BSAFE

SSL-J 6.2.6 Troubleshooting Guide

This document provides information and instructions for troubleshooting common

issues for RSA BSAFE SSL-J 6.2.6 (SSL-J) on all released platforms.

Contents:

JCE Unlimited Strength Jurisdiction Policy Files ......................................... 2

Use SSL-J in FIPS-140 Mode in Compliance with FIPS 140-2

Requirements ................................................................................................... 3

Decrease the Time Taken for Cryptographic Operations ........................... 3

Convert Oracle JKS Keystore to PKCS #12 format .................................... 4

Errors when Running a Java Web Start Application ................................... 4

Use SSL-J with J2EE Applications and Application Servers ..................... 5

Static Registration ..................................................................................... 5

Dynamic Registration ............................................................................... 5

Explicit use of Provider Instances ........................................................... 6

How to Use a Cipher Suite That is Not in the Default List .......................... 7

SSL-J JSSE Provider ............................................................................... 7

SSLJ API .................................................................................................... 8

Inter-operability Issue with OpenSSL Server when using PSK ................. 9

Summary of content (9 pages)

PAGE 1
Troubleshooting Guide 13.11.19 RSA BSAFE® SSL-J 6.2.6 Troubleshooting Guide This document provides information and instructions for troubleshooting common issues for RSA BSAFE SSL-J 6.2.6 (SSL-J) on all released platforms. Contents: JCE Unlimited Strength Jurisdiction Policy Files ......................................... 2 Use SSL-J in FIPS-140 Mode in Compliance with FIPS 140-2 Requirements ...................................................................................................
PAGE 2
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide JCE Unlimited Strength Jurisdiction Policy Files The JCE framework requires that Unlimited Strength Jurisdiction Policy Files are downloaded and installed in order to use some algorithms and key strengths using the JCE API.
PAGE 3
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide Use SSL-J in FIPS-140 Mode in Compliance with FIPS 140-2 Requirements To ensure that SSL-J is used in the FIPS 140 mode in compliance with FIPS 140-2 requirements, complete the following: • • Use the correct jar file: – For non-Android environments, use the jcmFIPS-6.2.5.jar file – For Android environments, use the jcmandroidfips-6.2.5.jar file. Set the initial FIPS-140 mode of operation security property com.rsa.cryptoj.
PAGE 4
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide Convert Oracle JKS Keystore to PKCS #12 format The keytool utility has an importkeystore option, for JDK1.6.
PAGE 5
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide Use SSL-J with J2EE Applications and Application Servers Java Application Servers use a hierarchy of class loaders to isolate the applications in the Web and Enterprise JavaBeans containers. The use of class loaders affects how SSL-J can be used in this environment. Static Registration SSL-J can be statically registered and successfully used in most Application Server environments.
PAGE 6
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide Where applications have their own copies of SSL-J, it is possible for one application to use a combination of classes from its own SSL-J jars along with those from an RsaJsse instance registered by a different application. Problems such as unexpected ClassCastExceptions and unrecognized AlgorithmParameters can result. This can even occur with a single application as it is being upgraded as there may briefly be two instances of the same application.
PAGE 7
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide How to Use a Cipher Suite That is Not in the Default List As weaknesses are found in cryptographic algorithms, such as RC4, and as computers get faster and algorithms no longer support keys of sufficient strength, such as DES, some cipher suites that have previously been commonly used are no longer considered secure. These cipher suites are, by default, not enabled in recent versions SSL-J.
PAGE 8
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide SSLJ API If using the SSLJ API, invoke setCipherSuites() on the SSLParams instance before passing it as a parameter to the com.rsa.ssl.SSLSocket or com.rsa.ssl.SSLServerSocket constructor. For example: SSLParams params = new SSLParams(); // Set the enabled cipher suites. CipherSuite[] cipherSuites = { ECDHE_RSA_With_RC4_128_SHA.INSTANCE, ECDHE_ECDSA_With_RC4_128_SHA.INSTANCE }; params.
PAGE 9
RSA BSAFE SSL-J 6.2.6 Troubleshooting Guide Inter-operability Issue with OpenSSL Server when using PSK When using the pre-shared key (PSK) method and the -psk_hint option to connect to an OpenSSL server, the secure negotiations may fail with the following error on the server: PSK error: client identity not found (got expected 'Client_identity') The OpenSSL server always uses the default value, Client_identity, for the –psk_hint.